@decentnetwork/lan 0.1.195 → 0.1.197

package/dist/cli/commands.js

@@ -1423,8 +1423,9 @@ export async function cmdProxyTrustCa(args) {
     if (process.platform === "linux") {
         // WSL: the browser runs on the WINDOWS side and trusts the WINDOWS cert
         // store — installing into this distro's Linux store does nothing for it.
-        // certutil.exe is callable from WSL and the per-user ROOT store needs no
-        // admin (Windows pops a confirmation dialog the user must accept).
+        // certutil -user -addstore ROOT is rejected on modern Windows
+        // (0x80070032 ERROR_NOT_SUPPORTED); PowerShell Import-Certificate into
+        // CurrentUser\Root works without admin (Windows pops a confirmation dialog).
         const isWsl = existsSync("/proc/version") &&
             readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
         if (isWsl) {
@@ -1434,19 +1435,20 @@ export async function cmdProxyTrustCa(args) {
             try {
                 copyFileSync(caCertPath, winCopy);
                 console.log("A Windows security dialog will pop up — click Yes to trust the CA...");
-                const w = spawnSync("certutil.exe", ["-user", "-addstore", "-f", "ROOT", winPath], { stdio: "inherit" });
+                const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${winPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
                 if (w.status === 0) {
                     console.log("✓ Windows store updated. Chrome/Edge on Windows pick it up immediately (reload the page).");
                 }
                 else {
-                    console.log("Install failed or dialog declined — in a Windows terminal run:");
-                    console.log(`  certutil -user -addstore -f ROOT "${winPath}"`);
+                    console.log("Install failed or dialog declined — in a Windows PowerShell run:");
+                    console.log(`  Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+                    console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${winPath}")`);
                 }
             }
             catch (e) {
                 console.log(`Could not copy the cert to the Windows side (${e.message}). Manually:`);
                 console.log(`  cp "${caCertPath}" ${winCopy}`);
-                console.log(`  certutil.exe -user -addstore -f ROOT "${winPath}"`);
+                console.log(`  then in Windows PowerShell: Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
             }
             console.log("(Linux-side clients like curl inside WSL would additionally need the system CA store:");
             console.log(`  sudo cp "${caCertPath}" /usr/local/share/ca-certificates/agentnet-mitm-ca.crt && sudo update-ca-certificates)`);
@@ -1464,13 +1466,14 @@ export async function cmdProxyTrustCa(args) {
     }
     if (process.platform === "win32") {
         console.log("Installing into the Windows user trust store (a security dialog will pop up — click Yes)...");
-        const w = spawnSync("certutil", ["-user", "-addstore", "-f", "ROOT", caCertPath], { stdio: "inherit" });
+        const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${caCertPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
         if (w.status === 0) {
             console.log("✓ Trusted. Chrome/Edge pick it up immediately (reload the page).");
         }
         else {
-            console.log("Install failed or dialog declined — run manually (admin terminal for the machine store):");
-            console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+            console.log("Install failed or dialog declined — in PowerShell run:");
+            console.log(`  Import-Certificate -FilePath "${caCertPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+            console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${caCertPath}")`);
         }
         return;
     }

package/dist/proxy/hls-prefetch.d.ts

@@ -29,6 +29,14 @@ export declare function capM3u8Variants(playlist: string, maxBandwidth: number):
  * reloading the capped master playlist. The proxy can use this map to fetch the
  * safe media playlist while preserving the browser-facing request URL. */
 export declare function buildM3u8VariantFallbacks(playlist: string, baseUrl: string, maxBandwidth: number): Map<string, string>;
+/** Resolve one HTTP byte-range against a complete cached body. Multiple ranges
+ * are intentionally rejected (the CCTV player uses only a single range). */
+export declare function sliceHttpByteRange(body: Buffer, header: string): {
+    body: Buffer;
+    start: number;
+    end: number;
+    total: number;
+} | null;
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/hls-prefetch.js

@@ -128,6 +128,31 @@ export function buildM3u8VariantFallbacks(playlist, baseUrl, maxBandwidth) {
     }
     return out;
 }
+/** Resolve one HTTP byte-range against a complete cached body. Multiple ranges
+ * are intentionally rejected (the CCTV player uses only a single range). */
+export function sliceHttpByteRange(body, header) {
+    const match = /^bytes=(\d*)-(\d*)$/i.exec(header.trim());
+    if (!match || (match[1] === "" && match[2] === "") || body.length === 0)
+        return null;
+    const total = body.length;
+    let start;
+    let end;
+    if (match[1] === "") {
+        const suffix = Number(match[2]);
+        if (!Number.isSafeInteger(suffix) || suffix <= 0)
+            return null;
+        start = Math.max(0, total - suffix);
+        end = total - 1;
+    }
+    else {
+        start = Number(match[1]);
+        end = match[2] === "" ? total - 1 : Number(match[2]);
+        if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || start >= total || end < start)
+            return null;
+        end = Math.min(end, total - 1);
+    }
+    return { body: body.subarray(start, end + 1), start, end, total };
+}
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/multi-exit-router.js

@@ -21,7 +21,7 @@ import https from "node:https";
 import net from "node:net";
 import tls from "node:tls";
 import { egressConnect } from "./egress.js";
-import { HlsPrefetcher, buildM3u8VariantFallbacks, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
+import { HlsPrefetcher, buildM3u8VariantFallbacks, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments, sliceHttpByteRange } from "./hls-prefetch.js";
 import { RouteLearner } from "./route-learner.js";
 import { GeoCnClassifier } from "./geo-cn.js";
 import { MitmGateway } from "./mitm-gateway.js";
@@ -116,6 +116,11 @@ const EXIT_CONNECT_TIMEOUT_MS = 4000;
 // underestimates by ~5x and poisons the ordering. Video segments clear this;
 // API calls and redirects don't (they stay unmeasured = balanced by load).
 const SPEED_MIN_BYTES = 512 * 1024;
+// The 600 kbps CCTV fallback produces ~390-430 KB four-second segments. They
+// are large enough to rank an exit, but never crossed the generic 512 KB gate,
+// leaving every exit "unproven" and rotating foreground playback across slow
+// paths. Keep the generic gate conservative and use this only for HLS bodies.
+const HLS_SPEED_MIN_BYTES = 256 * 1024;
 // We record PEAK 1-second throughput within a transfer, not lifetime average,
 // so slow-start ramp-up doesn't drag the estimate down.
 const SPEED_WINDOW_MS = 1000;
@@ -159,10 +164,16 @@ const NEAR_DEAD_EXIT_BPS = 60_000;
 // threshold admitted 10.86.15.133 on a short peak even though its full CCTV
 // segments averaged only 0.7-1.2 Mbit/s, causing each half-range to take 4-6s.
 const HLS_DELIVERY_BPS = 200_000;
-// Stability-first default for constrained exit pools. Set 0 to expose every
-// origin variant, or 1800000 to restore CCTV 720P when another fast exit joins.
+// Below this speed even a 0.9 Mbps stream has no useful headroom. If
+// unproven exits remain, keep exploring them instead of locking startup onto
+// the first measured-but-dead path (observed: 0.3 Mbps 15.133 hid the actually
+// usable 134.139 for the remainder of the router process).
+const HLS_STARTUP_EXPLORE_BPS = 100_000;
+// Quality selection belongs to the player/user by default. Operators may set a
+// positive value to impose an explicit site-local ceiling; 0 exposes every
+// origin variant.
 const HLS_MAX_VARIANT_BPS = process.env.AGENTNET_HLS_MAX_BPS === undefined
-    ? 900_000
+    ? 0
     : Math.max(0, Number(process.env.AGENTNET_HLS_MAX_BPS));
 export function isUsefulRecoverySample(peakBps, averageBps, minBps = HLS_DELIVERY_BPS) {
     return peakBps >= minBps && averageBps >= minBps;
@@ -235,12 +246,14 @@ function floorExit(exit) {
 /** Feed one tunnel's rate meter into the exit's speed EWMA (peak-window based).
  *  Only transfers past SPEED_MIN_BYTES count — smaller ones never reveal path
  *  capacity on a high-RTT link. */
-function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
+function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS, minBytes = SPEED_MIN_BYTES, useWholeAverage = false) {
     exit.bytesDown += meter.total;
-    if (meter.total < SPEED_MIN_BYTES)
+    if (meter.total < minBytes)
         return;
-    const bps = meter.peakBps(durMs);
-    if (bps <= 0)
+    const peakBps = meter.peakBps(durMs);
+    const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
+    const bps = useWholeAverage ? Math.min(peakBps, averageBps) : peakBps;
+    if (bps <= 0 || averageBps <= 0)
         return;
     if (exit.flooredAtMs !== null) {
         // FLOOR_BPS is a penalty, not a real historical sample. A qualifying probe
@@ -251,8 +264,7 @@ function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
         // also prove whole-segment average throughput. A probe observed at a 0.9
         // Mbit/s peak but only 0.6 Mbit/s average caused six-way prefetch/hedge
         // congestion when it rejoined a 1.8 Mbit/s stream.
-        const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
-        if (isUsefulRecoverySample(bps, averageBps, recoveryMinBps)) {
+        if (isUsefulRecoverySample(peakBps, averageBps, recoveryMinBps)) {
             exit.speedEwma = bps;
             exit.flooredAtMs = null;
         }
@@ -287,10 +299,14 @@ export function selectHlsPrimaryPool(pool) {
     // still safer than falling back to every unproven/degraded exit. This is the
     // adaptive-bitrate path: the master playlist is capped separately, while
     // foreground delivery stays on the least-bad known tier.
+    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
     const measured = pool.filter((e) => e.flooredAtMs === null && e.speedEwma !== null);
-    if (measured.length > 0)
+    if (measured.length > 0) {
+        const bestMeasured = Math.max(...measured.map((e) => e.speedEwma ?? 0));
+        if (bestMeasured < HLS_STARTUP_EXPLORE_BPS && unproven.length > 0)
+            return unproven;
         return fastestTier(measured);
-    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
+    }
     return unproven.length > 0 ? unproven : pool;
 }
 /** Dynamic prefetch concurrency follows only the foreground-safe pool. */
@@ -1315,7 +1331,7 @@ export function startMultiExitRouter(opts) {
                             nextExit(`empty ${status}`);
                             return;
                         }
-                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS);
+                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS, HLS_SPEED_MIN_BYTES, true);
                         if (label) {
                             const kb = (body.length / 1024).toFixed(0);
                             const mbps = durMs > 0 ? ((body.length * 8) / durMs / 1000).toFixed(1) : "?";
@@ -1361,17 +1377,14 @@ export function startMultiExitRouter(opts) {
             tryIdx(0);
         });
     }
-    // Striping ON — PROVEN to aggregate: a 600KB range that takes 8.5s on one
-    // China exit (0.57 Mbps) lands in 3.9s when split 3 ways across exits
-    // (1.24 Mbps, 2.2×). The GFW throttles PER-CONNECTION, so parallel ranges on
-    // separate exit tunnels sum. A tiny 2-byte probe learns the size, then the
-    // whole body is pulled as parallel byte-ranges; each range is hedged
-    // (timeout → retry another exit) and the empty-body trip + min-throughput
-    // deadline in fetchViaRegionBuffered keep a dead/trickling exit from stalling
-    // it. Player requests JOIN an in-flight prefetch (dedup) so bandwidth isn't
-    // split fetching the same segment twice. concurrency:2 keeps at most 2
-    // segments (≈6 stripes over ~3 exits) in flight so the pool isn't overwhelmed.
-    const AGG = process.env.AGENTNET_HLS_STRIPES ? Math.max(1, Number(process.env.AGENTNET_HLS_STRIPES)) : 3;
+    // Striping can aggregate genuinely independent exits, but it is harmful when
+    // every range converges on one useful shared exit. Three stripes, a hedge per
+    // stripe, and retries produced 6-11 simultaneous requests to 10.86.134.139;
+    // its measured throughput collapsed from ~2 Mbps to ~0.3 Mbps and every
+    // client sharing that exit stalled. Default to one whole-segment fetch (with
+    // the existing single late hedge). Operators may explicitly opt into more
+    // stripes after proving their exits have independent capacity.
+    const AGG = process.env.AGENTNET_HLS_STRIPES ? Math.max(1, Number(process.env.AGENTNET_HLS_STRIPES)) : 1;
     // How many china exits are ACTUALLY delivering right now — healthy (or with
     // live traffic), not tripped, and not speed-penalized (an exit that returned
     // empty/0-byte gets its score floored, so it drops out here until it serves
@@ -1391,16 +1404,13 @@ export function startMultiExitRouter(opts) {
             return false;
         const now = Date.now();
         return exits.some((e) => e.region === fallbackRegion && e.trippedUntil <= now &&
-            e.flooredAtMs === null && e.speedEwma !== null);
+            e.flooredAtMs === null && e.speedEwma !== null && e.speedEwma >= HLS_STARTUP_EXPLORE_BPS);
     };
-    // Stripe count is a connection count, not a distinct-exit count. Keep three
-    // parallel ranges even when only one exit is qualified: two ranges still
-    // delivered CCTV's 1800 stream in 3.6-4.9s, which is marginal for a 4s live
-    // segment, while one connection repeatedly showed 6-10s tails. During
-    // startup, keep whole-segment mode until at least one
-    // exit has delivered a real fast sample; otherwise the unproven startup pool
-    // would scatter half-ranges onto every slow exit and hold assembly hostage.
-    // Set AGENTNET_HLS_STRIPES=1 for an emergency rollback.
+    // Stripe count is a connection count, not a distinct-exit count. During
+    // startup, keep whole-segment mode until at least one exit has delivered a
+    // real fast sample; otherwise the unproven startup pool would scatter ranges
+    // onto every slow exit and hold assembly hostage. AGENTNET_HLS_STRIPES=N is
+    // an explicit opt-in for pools where N independent exits are proven useful.
     const usableChinaExits = () => AGG <= 1 || !hasMeasuredChinaExit() ? 1 : AGG;
     const hlsConcurrency = () => hasMeasuredChinaExit() ? deliveringChinaExits() : 1;
     // Prefetch parallelism = the number of exits ACTUALLY delivering right now
@@ -1468,23 +1478,36 @@ export function startMultiExitRouter(opts) {
             res.end();
             return;
         }
-        const cacheable = method === "GET" && !headers["range"];
+        const isPlaylist = looksLikePlaylist(u.pathname || "");
+        const isSegment = looksLikeSegment(u.pathname || "");
+        const requestedRange = typeof headers["range"] === "string" ? headers["range"] : null;
+        const cacheable = method === "GET";
         if (cacheable) {
             const hit = hls.lookup(fullUrl);
             if (hit) {
+                const ranged = requestedRange && isSegment ? sliceHttpByteRange(hit.body, requestedRange) : null;
+                if (requestedRange && isSegment && !ranged) {
+                    const hh = { "content-range": `bytes */${hit.body.length}`, "content-length": 0 };
+                    addCors(hh);
+                    res.writeHead(416, hh);
+                    res.end();
+                    return;
+                }
+                const body = ranged?.body ?? hit.body;
                 const hh = {
                     "content-type": hit.contentType ?? "application/octet-stream",
-                    "content-length": hit.body.length,
+                    "content-length": body.length,
                     "x-agentnet-cache": "hit",
+                    "accept-ranges": "bytes",
                 };
+                if (ranged)
+                    hh["content-range"] = `bytes ${ranged.start}-${ranged.end}/${ranged.total}`;
                 addCors(hh);
-                res.writeHead(200, hh);
-                res.end(hit.body);
+                res.writeHead(ranged ? 206 : 200, hh);
+                res.end(body);
                 bumpHlsStats();
                 return;
             }
-            const isPlaylist = looksLikePlaylist(u.pathname || "");
-            const isSegment = looksLikeSegment(u.pathname || "");
             if (isPlaylist || isSegment) {
                 const fwd = {};
                 for (const [k, v] of Object.entries(headers)) {
@@ -1530,17 +1553,33 @@ export function startMultiExitRouter(opts) {
                                 log(`  playlist ${host} is MEDIA — ${segs.length} segments, prefetching ahead`);
                         }
                     }
-                    log(`  MITM ${method} ${host}${(path || "/").slice(0, 80)} → ${r.status} (${r.body.length}B)`);
+                    let responseStatus = r.status;
+                    let responseBody = r.body;
+                    const outHeaders = { ...r.headers };
+                    if (requestedRange && isSegment && r.status === 200) {
+                        const ranged = sliceHttpByteRange(r.body, requestedRange);
+                        if (!ranged) {
+                            responseStatus = 416;
+                            responseBody = Buffer.alloc(0);
+                            outHeaders["content-range"] = `bytes */${r.body.length}`;
+                        }
+                        else {
+                            responseStatus = 206;
+                            responseBody = ranged.body;
+                            outHeaders["content-range"] = `bytes ${ranged.start}-${ranged.end}/${ranged.total}`;
+                            outHeaders["accept-ranges"] = "bytes";
+                        }
+                    }
+                    log(`  MITM ${method} ${host}${(path || "/").slice(0, 80)} → ${responseStatus} (${responseBody.length}B)`);
                     if (r.status >= 400) {
                         const snip = r.body.slice(0, 300).toString("utf8").replace(/\s+/g, " ");
                         log(`    body: ${snip}`);
                     }
-                    const outHeaders = { ...r.headers };
                     delete outHeaders["transfer-encoding"];
-                    outHeaders["content-length"] = r.body.length;
+                    outHeaders["content-length"] = responseBody.length;
                     addCors(outHeaders); // cache/dedup/striped paths drop the CDN's CORS header — always re-add
-                    res.writeHead(r.status, outHeaders);
-                    res.end(r.body);
+                    res.writeHead(responseStatus, outHeaders);
+                    res.end(responseBody);
                     if (r.status === 200) {
                         const ct = r.headers["content-type"];
                         if (isPlaylist) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.195",
+  "version": "0.1.197",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",